u/Harvey-Lane-251

we ran a pilot group expecting complaints about accuracy when we turned on copilot, but it turned into the most effective permissions auditor we've ever run, and entirely by accident at that.

what happened was someone asked it something totally normal about budgets and it pulled numbers from a finance folder that had been shared to "everyome in the org" during a reorganisation. this means that if your account can reach a file, copilot will read it, summarise and quote it back in the chat. I imagine this would translate to it auditing ten years of our sharepoint sharing.

If you made it past the pilot stage, how did you get through cleaning up the oversharing and did you find a way to see what people are feeding the non copilot AI tools?

I called it Melon Musk

Weighing this right now. Proofpoint's handling the volume, but what's getting through isn't the kind it catches, vendor emails asking to change bank details, wire instructions that are just text with nothing for a gateway to grab. I see how behavioral tools work for this, abnormal and the like baseline each person then flag when the sender doesn't read right and that's exactly the fraud we're losing to.

Can't get past this: is it a Proofpoint configuration issue or are they two fundamentally different threats that both need coverage and if so whether maintaining another appliance for that specific problem is worth the cost.

Running both in production or did one end up redundant?

Had a user get phished on one of the device code flows. MFA was on the whole time, though the guy had refresh tokens and was back in the mailbox within an hour.
we reset password, killed the sessions still he just kept waltzing back in. Took us a minute to clock that he'd added his own authenticator during the first compromise such that refresh tokens outlive a reset anyway.
The playbook revokes the tokens now and rips out any MFA method the user never set up. Now for the detection part, a fresh MFA method right after a dodgy sign in should be a screaming alert but everything i build just buries it under the normal enrollments.